berbew | 6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2025, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe
Size

128KB
MD5

a1a3e1d8c2e7155da2039929a60e33e6
SHA1

79ca632180818909c6a875400f1288098b8a6750
SHA256

6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597
SHA512

db00e8d229751e696e1b3b45a702be9d33425979aa9038897f1bbe32a22b47ef6dcafc565eab8313a07851bb47cc40d61d57f0cf765f9ac1022398ab129ea28a
SSDEEP

3072:SXTPMARBaZkp3Eje+9pui6yYPaI7DehizrVtNu:SXT0ARB5hYpui6yYPaIGck

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omjpeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkoch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlimed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifmqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kckqbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiahnnph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckqbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfjfecno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mqkiok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpfqcln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clchbqoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpnfge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqpcjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmaffnce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adfnofpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cofnik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgkfnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mokmdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinjhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coadnlnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hlbcnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alnfpcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cljobphg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljqhkckn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdcfidg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpenfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmaamn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmhpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Doaneiop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnoiqdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjoja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kflide32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njjdho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmbanbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ennqfenp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Malpia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nccokk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oeehkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfipef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oeokal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fngcmcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmkigh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhkfkmmg.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3696	Lmgabcge.exe
3664	Mglfplgk.exe
4936	Mjkblhfo.exe
2524	Mgobel32.exe
2136	Mnhkbfme.exe
4004	Mcecjmkl.exe
4964	Mnkggfkb.exe
2980	Meepdp32.exe
380	Mkohaj32.exe
540	Malpia32.exe
2708	Mgehfkop.exe
3968	Mmbanbmg.exe
4568	Meiioonj.exe
1492	Njfagf32.exe
3744	Nnbnhedj.exe
2212	Nelfeo32.exe
3636	Nndjndbh.exe
756	Nenbjo32.exe
3684	Nmigoagp.exe
3412	Nccokk32.exe
4248	Njmhhefi.exe
3616	Neclenfo.exe
3556	Nlmdbh32.exe
208	Najmjokc.exe
4984	Oeehkn32.exe
2180	Oloahhki.exe
4324	Omqmop32.exe
1680	Olanmgig.exe
4512	Omcjep32.exe
2452	Odmbaj32.exe
1804	Ojgjndno.exe
3536	Oelolmnd.exe
5092	Olfghg32.exe
3420	Omgcpokp.exe
3804	Oeokal32.exe
2968	Ohmhmh32.exe
852	Oogpjbbb.exe
2680	Omjpeo32.exe
940	Pddhbipj.exe
3680	Plkpcfal.exe
5024	Poimpapp.exe
4416	Pahilmoc.exe
3640	Phaahggp.exe
2512	Pkpmdbfd.exe
3264	Pmoiqneg.exe
3652	Pdhbmh32.exe
4948	Pkbjjbda.exe
4500	Pmaffnce.exe
1148	Pdkoch32.exe
4480	Plbfdekd.exe
3676	Popbpqjh.exe
3124	Paoollik.exe
2848	Phigif32.exe
4240	Pkgcea32.exe
4952	Qmepam32.exe
2796	Qemhbj32.exe
2160	Qlgpod32.exe
4552	Qoelkp32.exe
3084	Qmhlgmmm.exe
1996	Qdbdcg32.exe
2372	Qlimed32.exe
3840	Aogiap32.exe
4572	Aeaanjkl.exe
4932	Ahpmjejp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pkoaeldi.dll	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Nccokk32.exe	Nmigoagp.exe
File created	C:\Windows\SysWOW64\Pjinodke.dll	Albpkc32.exe
File created	C:\Windows\SysWOW64\Blqllqqa.exe	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Hmlephen.dll	Cbpajgmf.exe
File created	C:\Windows\SysWOW64\Cjgjmg32.dll	Hlpfhe32.exe
File opened for modification	C:\Windows\SysWOW64\Kpcjgnhb.exe	Knenkbio.exe
File created	C:\Windows\SysWOW64\Plbfdekd.exe	Pdkoch32.exe
File created	C:\Windows\SysWOW64\Abdkep32.dll	Ekodjiol.exe
File created	C:\Windows\SysWOW64\Hpchib32.exe	Hmdlmg32.exe
File created	C:\Windows\SysWOW64\Lahoec32.dll	Boldhf32.exe
File created	C:\Windows\SysWOW64\Cfipef32.exe	Cnahdi32.exe
File created	C:\Windows\SysWOW64\Ckeimm32.exe	Clchbqoo.exe
File opened for modification	C:\Windows\SysWOW64\Lmaamn32.exe	Ljceqb32.exe
File opened for modification	C:\Windows\SysWOW64\Njmhhefi.exe	Nccokk32.exe
File created	C:\Windows\SysWOW64\Cbbnpg32.exe	Cocacl32.exe
File created	C:\Windows\SysWOW64\Fneggdhg.exe	Flfkkhid.exe
File opened for modification	C:\Windows\SysWOW64\Hekgfj32.exe	Hblkjo32.exe
File created	C:\Windows\SysWOW64\Jbklgfdh.dll	Iliinc32.exe
File created	C:\Windows\SysWOW64\Cnocia32.dll	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Kofmfi32.dll	Oaifpi32.exe
File created	C:\Windows\SysWOW64\Dmadco32.exe	Ddjmba32.exe
File created	C:\Windows\SysWOW64\Pjdhbppo.dll	Jpcapp32.exe
File created	C:\Windows\SysWOW64\Dicdcemd.dll	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Conanfli.exe	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Cnahdi32.exe	Ckclhn32.exe
File opened for modification	C:\Windows\SysWOW64\Kflide32.exe	Kcmmhj32.exe
File created	C:\Windows\SysWOW64\Nmbjcljl.exe	Mgeakekd.exe
File opened for modification	C:\Windows\SysWOW64\Qpeahb32.exe	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Dddllkbf.exe	Dpiplm32.exe
File opened for modification	C:\Windows\SysWOW64\Nfjola32.exe	Nclbpf32.exe
File created	C:\Windows\SysWOW64\Hmhkgijk.dll	Mgehfkop.exe
File created	C:\Windows\SysWOW64\Jomnmjjb.dll	Blgifbil.exe
File opened for modification	C:\Windows\SysWOW64\Dmadco32.exe	Ddjmba32.exe
File created	C:\Windows\SysWOW64\Gepgfb32.dll	Ffnknafg.exe
File opened for modification	C:\Windows\SysWOW64\Jcdjbk32.exe	Jpenfp32.exe
File created	C:\Windows\SysWOW64\Jlolpq32.exe	Jcfggkac.exe
File created	C:\Windows\SysWOW64\Mlcdqdie.dll	Qjiipk32.exe
File opened for modification	C:\Windows\SysWOW64\Cbpajgmf.exe	Coadnlnb.exe
File created	C:\Windows\SysWOW64\Mpolbbim.dll	Nqpcjj32.exe
File created	C:\Windows\SysWOW64\Blnoga32.exe	Bhbcfbjk.exe
File created	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jpcapp32.exe
File created	C:\Windows\SysWOW64\Ncnofeof.exe	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Pnkbkk32.exe	Pfdjinjo.exe
File opened for modification	C:\Windows\SysWOW64\Caageq32.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Enhodk32.dll	Adfnofpd.exe
File opened for modification	C:\Windows\SysWOW64\Mcecjmkl.exe	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Olieecnn.dll	Jcdjbk32.exe
File created	C:\Windows\SysWOW64\Lmaamn32.exe	Ljceqb32.exe
File created	C:\Windows\SysWOW64\Oogpjbbb.exe	Ohmhmh32.exe
File opened for modification	C:\Windows\SysWOW64\Mnkggfkb.exe	Mcecjmkl.exe
File created	C:\Windows\SysWOW64\Hqdkac32.dll	Aaohcj32.exe
File created	C:\Windows\SysWOW64\Dnpdegjp.exe	Domdjj32.exe
File created	C:\Windows\SysWOW64\Fnipbc32.exe	Flkdfh32.exe
File created	C:\Windows\SysWOW64\Onmfimga.exe	Ojajin32.exe
File opened for modification	C:\Windows\SysWOW64\Oghghb32.exe	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Dhhmleng.dll	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Ddpapmqq.dll	Digehphc.exe
File opened for modification	C:\Windows\SysWOW64\Jenmcggo.exe	Jleijb32.exe
File opened for modification	C:\Windows\SysWOW64\Jpcapp32.exe	Jiiicf32.exe
File created	C:\Windows\SysWOW64\Eelche32.dll	Kgkfnh32.exe
File opened for modification	C:\Windows\SysWOW64\Ncnofeof.exe	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Aokkahlo.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Jheldb32.dll	Mcecjmkl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9460	10224	WerFault.exe	463

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iinjhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngjkfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blqllqqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fligqhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgobel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pddhbipj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmepam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekaapi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmkigh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jenmcggo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcdjbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oelolmnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plbfdekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efgemb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmbaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phaahggp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qoelkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gldglf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjdho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgehfkop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfagf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fihnomjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpchib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpoalo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmbjcljl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neclenfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alpbecod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnahdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emoadlfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gppcmeem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnepna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbchdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibfnqmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmhhefi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pahilmoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmaffnce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlimed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiloco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoideh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlolpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljeafb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmhpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnlmhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjlhgaqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nglhld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkoch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhnikc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modgdicm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcgiefen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nceefd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnifekmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Malpia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbdcg32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckkpjkai.dll"	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enhodk32.dll"	Adfnofpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chqogq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gnepna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnkggfkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pkbjjbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnidloo.dll"	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdabnm32.dll"	Omqmop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmoiqneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pkgcea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aogiap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cljobphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Accimdgp.dll"	Jmbhoeid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmjlphl.dll"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dijbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjmj32.dll"	Kckqbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhblffgn.dll"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aaohcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdnmfclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojpmg32.dll"	Pddhbipj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpmcbhlp.dll"	Qmhlgmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiboaq32.dll"	Dkceokii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofpnmakg.dll"	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmiadfmi.dll"	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpcjgnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lokdnjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnfihkqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmlme32.dll"	Mokmdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojajin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cofnik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjbcghk.dll"	Jiiicf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngidlo32.dll"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oelolmnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfoomidj.dll"	Pkgcea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnhkbfme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gppcmeem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lncjlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gadiippo.dll"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jheldb32.dll"	Mcecjmkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oogpjbbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Coadnlnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cghane32.dll"	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkceokii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ekaapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbhafkok.dll"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbopqlen.dll"	Phigif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Almoijfo.dll"	Knenkbio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjpda32.dll"	Lpfgmnfp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3696	1552	6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe	87
PID 1552 wrote to memory of 3696	1552	6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe	87
PID 1552 wrote to memory of 3696	1552	6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe	87
PID 3696 wrote to memory of 3664	3696	Lmgabcge.exe	88
PID 3696 wrote to memory of 3664	3696	Lmgabcge.exe	88
PID 3696 wrote to memory of 3664	3696	Lmgabcge.exe	88
PID 3664 wrote to memory of 4936	3664	Mglfplgk.exe	89
PID 3664 wrote to memory of 4936	3664	Mglfplgk.exe	89
PID 3664 wrote to memory of 4936	3664	Mglfplgk.exe	89
PID 4936 wrote to memory of 2524	4936	Mjkblhfo.exe	90
PID 4936 wrote to memory of 2524	4936	Mjkblhfo.exe	90
PID 4936 wrote to memory of 2524	4936	Mjkblhfo.exe	90
PID 2524 wrote to memory of 2136	2524	Mgobel32.exe	91
PID 2524 wrote to memory of 2136	2524	Mgobel32.exe	91
PID 2524 wrote to memory of 2136	2524	Mgobel32.exe	91
PID 2136 wrote to memory of 4004	2136	Mnhkbfme.exe	92
PID 2136 wrote to memory of 4004	2136	Mnhkbfme.exe	92
PID 2136 wrote to memory of 4004	2136	Mnhkbfme.exe	92
PID 4004 wrote to memory of 4964	4004	Mcecjmkl.exe	93
PID 4004 wrote to memory of 4964	4004	Mcecjmkl.exe	93
PID 4004 wrote to memory of 4964	4004	Mcecjmkl.exe	93
PID 4964 wrote to memory of 2980	4964	Mnkggfkb.exe	94
PID 4964 wrote to memory of 2980	4964	Mnkggfkb.exe	94
PID 4964 wrote to memory of 2980	4964	Mnkggfkb.exe	94
PID 2980 wrote to memory of 380	2980	Meepdp32.exe	95
PID 2980 wrote to memory of 380	2980	Meepdp32.exe	95
PID 2980 wrote to memory of 380	2980	Meepdp32.exe	95
PID 380 wrote to memory of 540	380	Mkohaj32.exe	97
PID 380 wrote to memory of 540	380	Mkohaj32.exe	97
PID 380 wrote to memory of 540	380	Mkohaj32.exe	97
PID 540 wrote to memory of 2708	540	Malpia32.exe	98
PID 540 wrote to memory of 2708	540	Malpia32.exe	98
PID 540 wrote to memory of 2708	540	Malpia32.exe	98
PID 2708 wrote to memory of 3968	2708	Mgehfkop.exe	99
PID 2708 wrote to memory of 3968	2708	Mgehfkop.exe	99
PID 2708 wrote to memory of 3968	2708	Mgehfkop.exe	99
PID 3968 wrote to memory of 4568	3968	Mmbanbmg.exe	101
PID 3968 wrote to memory of 4568	3968	Mmbanbmg.exe	101
PID 3968 wrote to memory of 4568	3968	Mmbanbmg.exe	101
PID 4568 wrote to memory of 1492	4568	Meiioonj.exe	102
PID 4568 wrote to memory of 1492	4568	Meiioonj.exe	102
PID 4568 wrote to memory of 1492	4568	Meiioonj.exe	102
PID 1492 wrote to memory of 3744	1492	Njfagf32.exe	103
PID 1492 wrote to memory of 3744	1492	Njfagf32.exe	103
PID 1492 wrote to memory of 3744	1492	Njfagf32.exe	103
PID 3744 wrote to memory of 2212	3744	Nnbnhedj.exe	104
PID 3744 wrote to memory of 2212	3744	Nnbnhedj.exe	104
PID 3744 wrote to memory of 2212	3744	Nnbnhedj.exe	104
PID 2212 wrote to memory of 3636	2212	Nelfeo32.exe	106
PID 2212 wrote to memory of 3636	2212	Nelfeo32.exe	106
PID 2212 wrote to memory of 3636	2212	Nelfeo32.exe	106
PID 3636 wrote to memory of 756	3636	Nndjndbh.exe	107
PID 3636 wrote to memory of 756	3636	Nndjndbh.exe	107
PID 3636 wrote to memory of 756	3636	Nndjndbh.exe	107
PID 756 wrote to memory of 3684	756	Nenbjo32.exe	108
PID 756 wrote to memory of 3684	756	Nenbjo32.exe	108
PID 756 wrote to memory of 3684	756	Nenbjo32.exe	108
PID 3684 wrote to memory of 3412	3684	Nmigoagp.exe	109
PID 3684 wrote to memory of 3412	3684	Nmigoagp.exe	109
PID 3684 wrote to memory of 3412	3684	Nmigoagp.exe	109
PID 3412 wrote to memory of 4248	3412	Nccokk32.exe	110
PID 3412 wrote to memory of 4248	3412	Nccokk32.exe	110
PID 3412 wrote to memory of 4248	3412	Nccokk32.exe	110
PID 4248 wrote to memory of 3616	4248	Njmhhefi.exe	111

C:\Users\Admin\AppData\Local\Temp\6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe
"C:\Users\Admin\AppData\Local\Temp\6b0214be1498384bf386e9a8942756766e0bd81fb29dfdb4e690f7831260f597.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\Lmgabcge.exe
  C:\Windows\system32\Lmgabcge.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\SysWOW64\Mglfplgk.exe
    C:\Windows\system32\Mglfplgk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SysWOW64\Mjkblhfo.exe
      C:\Windows\system32\Mjkblhfo.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2524
      - C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        24⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        25⤵
        Executes dropped EXE
        
        PID:208
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4324
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        29⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        30⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        32⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        34⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        35⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:852
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        42⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3640
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        45⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        47⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1148
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        52⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        53⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2848
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        57⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        58⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        64⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        65⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        66⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        67⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3400
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        70⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3444
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        73⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        74⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        75⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        76⤵
        Drops file in System32 directory
        
        PID:3524
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        77⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        79⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        80⤵
        Modifies registry class
        
        PID:520
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        81⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        82⤵
        Drops file in System32 directory
        
        PID:4992
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        83⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        85⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        86⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        88⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        89⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        90⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        91⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        92⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        97⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        99⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        101⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        102⤵
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        104⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        106⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        107⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        109⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        110⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        111⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        112⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        114⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        115⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        117⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        118⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        119⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        120⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        121⤵
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        122⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        123⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        124⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        125⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        127⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        128⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        129⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        130⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        131⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        132⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        134⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        135⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        136⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        137⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        138⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        139⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        141⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        142⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        144⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        146⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        147⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        149⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        150⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        151⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        153⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        154⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        155⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        157⤵
        Drops file in System32 directory
        
        PID:7148
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        158⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        159⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        160⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        161⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6452
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        163⤵
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        165⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        166⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        168⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        169⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        171⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        172⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        175⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        176⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        178⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        180⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        182⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        184⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        185⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        186⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        188⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        189⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        190⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        191⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        192⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6652
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        194⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        195⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        196⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        197⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        198⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        199⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        200⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        201⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        205⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        206⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        207⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        208⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        209⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        210⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        211⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:7956
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8000
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        215⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        216⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        217⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        218⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        219⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7324
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        221⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:7496
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        224⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        225⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        226⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        227⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        228⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        229⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        230⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        231⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        232⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        233⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7444
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        236⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        237⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        238⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        240⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8152
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        241⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        242⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        243⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7836
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        245⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        246⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        247⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7784
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        249⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        253⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        255⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        256⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        257⤵
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        258⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        259⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        260⤵
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        261⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        262⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        263⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        264⤵
        Modifies registry class
        
        PID:8576
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        266⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        267⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        268⤵
        Drops file in System32 directory
        
        PID:8752
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8796
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        270⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:8932
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        273⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        274⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9072
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9116
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        277⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        278⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        279⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        280⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        282⤵
        Drops file in System32 directory
        
        PID:8784
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8840
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        286⤵
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:8988
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        288⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        289⤵
        Drops file in System32 directory
        
        PID:9164
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        290⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        291⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        292⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8592
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        294⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8700
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8736
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        296⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        297⤵
        Modifies registry class
        
        PID:8836
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:8972
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9064
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        300⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        301⤵
        System Location Discovery: System Language Discovery
        
        PID:8248
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8584
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        303⤵
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        304⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        305⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        306⤵
        Modifies registry class
        
        PID:9092
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        307⤵
        Drops file in System32 directory
        
        PID:8260
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        309⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        310⤵
        Drops file in System32 directory
        
        PID:8964
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        311⤵
        Modifies registry class
        
        PID:8208
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:8692
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        313⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9128
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        315⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:8876
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        317⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        318⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        319⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        320⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:9296
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        322⤵
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        323⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        324⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9472
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        326⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9560
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9604
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        329⤵
        Modifies registry class
        
        PID:9648
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        330⤵
        Drops file in System32 directory
        
        PID:9692
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9736
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        332⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        333⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        335⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        336⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        337⤵
        System Location Discovery: System Language Discovery
        
        PID:10008
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        339⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        340⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        341⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        342⤵
        Drops file in System32 directory
        
        PID:10228
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        343⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        344⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        345⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9480
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9556
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        348⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        349⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        350⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        351⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9820
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        352⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        353⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        354⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        355⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:10172
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9220
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        358⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        359⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9568
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        363⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        364⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        365⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:10016
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        367⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        368⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10224 -s 420
        369⤵
        Program crash
        
        PID:9460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10224 -ip 10224
1⤵
PID:5496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aknbkjfh.exe

Filesize
128KB

MD5
1225e91b8516e306ced21e711b026872

SHA1
819b56be7a0cf6265342be5667655da71897d2e8

SHA256
c16b240e73959ce63f2dd3403c2f77423f103a6413f26bf7280777d0a2176609

SHA512
2fc3709b64784574244a0167e3b872307cd93831a8b30ec4ac32645e58bbf3384930b2024b159b7a74b2b4d8c1701f1d8d2b3aaf9702fd5f457e2e13b3ea2329

Download Submit
C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
128KB

MD5
9bf8e82de4f4afffa954821ecc41a84d

SHA1
88785de5178a321b0a068d5277320299f36b5f59

SHA256
42a3fe062a1f2e036d6bed28621d58ed7b4a8a4fcdfe1edbf4bdece0954a5ed5

SHA512
600039f3d195fdfedabb3d549c0e6707c3eed62a301f857bb4867c910e9749b3247863848ab3dd92c109ad15f9cfc366db29dd0de7b550ccf22e8163cbe17187

Download Submit
C:\Windows\SysWOW64\Blnoga32.exe

Filesize
128KB

MD5
61e0f0146b634e5bc3de1c56deaaad3e

SHA1
0b4cc1e2b8ba23912ce9b2f8c0a15509454dd2c5

SHA256
7f3884d8b4aaf0888d7e4a5e0de3e1aa2b6121fe071b235d5a771c8f9e306a15

SHA512
6437b832917ec6c21a13bb57652a431f9fdca466089b0f5467f9c64f5e5f5029130563a5c8ac75a850f72f3ffbc66bd357372ca76e9f8c7468070c2d55c6862f

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
128KB

MD5
a720e3a20d24bb2b88b88d7db130e910

SHA1
1008058fc570bd6000dbc0f373829ac47b0299f4

SHA256
95984994d60375525c1a675605e09f516cb657745e26c4d2af475287b3638f36

SHA512
2c4a1c94ebf3e08dd725a99d50f48b5484b520be14300fbf131477f0f86cb43e430a1749f0455ad8193bbb8a97a693dc2a3f1542956a4a4f58b7921c5c2dddff

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
128KB

MD5
53231a873a86056519166cae3b7a32bc

SHA1
36b94f007728b2447ab736c3cacfcef9208ca10e

SHA256
67ffe7b43cca2fa84597e3aa0f6090b977f72c145f4afe2235cf571aa347194e

SHA512
0dc62940ab1e7d4493c244dfe6fff7e787c0abb9c2e6ceb14f6f52031b6c6c688318b48e0749c7513b0ef2463299ee0ff86ac877972db6368ea717e7622c8595

Download Submit
C:\Windows\SysWOW64\Chqogq32.exe

Filesize
128KB

MD5
ccec37a0fe47192a1ab336fdb88ce8a0

SHA1
ad151ecf5e2bedd14e956f973283f638f7687f36

SHA256
097e86347b7886e33ea9a98c5f5eebd59b90000552d35fe0630872857c590119

SHA512
defe1099ea9f9eee2f208fe5e8b8bd1efd85d63b220f1bc098d3f10e7181f531d68241e0d36af570cff9a7e3992225cf6154fd5e8eec214856ffb6c22214ed44

Download Submit
C:\Windows\SysWOW64\Conanfli.exe

Filesize
128KB

MD5
78740b3e93ab3346d0c8ac8f2851693a

SHA1
c3001f4f70bd8e6703ab7c739f17aa7ebfed3212

SHA256
dc7915ce6265583f5859d30562c9583626e74e68c1c49197fab054b51ece7a39

SHA512
87ed4b687c66d344ae0f54d458cdb1d508202a9639fb028f96c71666c1c600351ed812d8bb11b475d4e25d204628d9fe3cea0e6328518229d9f56bafb73017db

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
128KB

MD5
cb12134cb1a7a9de77b87d5cea69cc33

SHA1
e923d62e01bd5b95b65c3b65b060069fc76b4810

SHA256
459f315f2344c094ac6418653880a3e1e149c80aa44535dec3ac60c60e3409a7

SHA512
03fe0e53d3963104798bfe34be0922962af2e0161c0ddee971b91ac532328c49791f077e2ef6244ebffba00810eb0c633b7040be5c5cc67b2144cf59ce2ce253

Download Submit
C:\Windows\SysWOW64\Dkhkgplb.dll

Filesize
7KB

MD5
e381efc90434d0f8f92136db678a12f5

SHA1
e1a1db5385c188486a2b53c665d535b218a55531

SHA256
e887c97cd8c2dd7309e06daea06415def4b784e689d66c2dfa3379caac64ad21

SHA512
ee1853304ae2a39da0f250302c32eae2d8ff8ab8ecfb57a80ad7ba57a9f7233d4ec1ca0c3ffa111bb68c22c797a8f9f77b3642698bfd4f050aa40d320711f09f

Download Submit
C:\Windows\SysWOW64\Eehicoel.exe

Filesize
128KB

MD5
511f0b1a75c18d2521e1ecb9276a42ea

SHA1
378653ffbf9806287734d97d99bef76b6d8ae082

SHA256
4d0f50fbf09bedd5faa9537ef595f4de8508e4417a8bc0102b2fd5f33ccc6d68

SHA512
8f63e7eda9abdbe4a75deff26cf8f677b8e64299dd3ea72f8c2fcd5631aa3b3a33938bc7da8bb06291833c44f48d472bf8de793ab8392143b58361a92a9f74fa

Download Submit
C:\Windows\SysWOW64\Fbjena32.exe

Filesize
128KB

MD5
40eb45b9c05f28cc5f56e69bb19598ac

SHA1
5409c2055172369c53d311b7a0caa83964b7560f

SHA256
2647a42833c4468ea06cbfb2a490adbbc2bd5bd4d7efd3ed87fc64168db963f2

SHA512
96421f73b124fa356abeb854416d5e07b9ec185cf35400c50612ba11ce35a6e793e1c9419385394088f99acf24979b5be410826f5eedffc9c3d0f8888d90afa9

Download Submit
C:\Windows\SysWOW64\Ffnknafg.exe

Filesize
128KB

MD5
595c0d363f394974784afaf28b6d2908

SHA1
dda27f3ae62822c54527190560007e7cc4e701f9

SHA256
17833e571e13ebeada7abb7fe41c1e76eed576c5c0f178c85763400395153075

SHA512
9900d47c0c7a6c14907cee5da8881803a72ba4a4b0942409482a001d7414d9af669561daf82f29140d8055b75e0f90f6df20cbe5ff23c2c2899372b7f0118147

Download Submit
C:\Windows\SysWOW64\Fnipbc32.exe

Filesize
128KB

MD5
81f30c44c01d0db5d55a4b385a6a0d86

SHA1
57f089c4ffe49a4d14959773704a76d639c03a1a

SHA256
14e3d84f674f14465b1250d5e1a98c0cbfaf42cde277c9821ae281ea47b264ec

SHA512
28c7e6299f08db2fe524b778dc107346cca38063250171c9885f363460e68abeaae21fb96b45b3602f76d685d3beb6126157c238490b5f4f81ad0cd8234d44bf

Download Submit
C:\Windows\SysWOW64\Gbeejp32.exe

Filesize
128KB

MD5
683848914fec51fe5638c7915337a8f8

SHA1
f11b8e82c54dd47c675c55b9e9f674fb55dee6cc

SHA256
223e2f7848fafd52fe8a322edde4303874893397507b419fa4b0d18b66537bad

SHA512
4e5a56e11477e3bf35aa26498bbe9672cab4f8c76a431f6963eb57d745bc7b75487b64a62aa5da934f2a5be67086e91ec285c3af613bf617510b1770ea29df67

Download Submit
C:\Windows\SysWOW64\Glgcbf32.exe

Filesize
128KB

MD5
bb93856bef1ad1ada40b867ddbdb558e

SHA1
10fd5acac3dc65733273231438ee02e32c6f673c

SHA256
7527356f85c176045264b98bd2530ab6b4500f75d5f0a5ff42f2de6ca75512ac

SHA512
94e5e2e98be6bf2fa535a488f26ad6a3335a590d3dfb7a92c42158d22cb603a1990362f469921f2d44783b83a4428ff884fe7a81f58b4d07864e646f0188999d

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
128KB

MD5
fc85b98d01e9f5107cc16fd74528a9e4

SHA1
7fcf740ee7960249e0e9073efcb5fdbeb234774b

SHA256
ec54e8e7d78debb99fc6e366c92abe91adddf6dff36792b5e613d22e123061d0

SHA512
eb3dae93de45c699875e05b878862a3afb1cb2c2e84e7ec68463de550ae38394b82c4e79fbdb24789d7a1ff48d81b3d912051e0c0a80916d87416f1d1b709bff

Download Submit
C:\Windows\SysWOW64\Hifcgion.exe

Filesize
128KB

MD5
fb16bd5de852897ee1b9a7259dc5ee36

SHA1
8f43458a91fb20329ae1b7678f203c84e08a334d

SHA256
5a4b3441816ae892ba81f943487a74a75f1af8735f759ea7ef10ccb7ce3ddbb0

SHA512
c41875bd8515858d4b45532fcacdf8a08110cd84fbb4d973e77513f97d37a8e0ed57fc9e49b7fa491c15b68cffb8602206955a9a54e02b767960a8dc6ea15675

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
128KB

MD5
e11fc77fe52927953aa05958fae539c3

SHA1
50a1362e660724c4c7c034ae08125001bfcc07af

SHA256
5d7503c44b01ecc86232b32ab5be0700c82334f9c266d1cebc85011d79ec29b1

SHA512
b026f20ec788c625ecc66cd1dcd3d48bf6634a15a6116d0303fc06a17f66b75df8da25a5f6c39455597e359f4fa3b448c0278e8cf04025b8ad03d3e90b18f0e8

Download Submit
C:\Windows\SysWOW64\Iinjhh32.exe

Filesize
128KB

MD5
8c2f62dcd0a41782e7217fa336424aad

SHA1
074fca790b840c2bf5d19d679cde741e02f3121d

SHA256
63bfb29dce5cc59b0abe6a441ef52ff52b8e2ba24bfb78eb6f73013d68f22552

SHA512
d9a9b97997a70090b1908bb1f3bd825d6a4b6304abd04b91466c2207f5719a01d816f004e4cfea8b5ef792090b43bfa27d4a459f5cd1a9b46bc206cf1a896413

Download Submit
C:\Windows\SysWOW64\Impliekg.exe

Filesize
128KB

MD5
81acece38ecd7ef99aa4973727bdc905

SHA1
a4fab154889176044a34e79780b4b00e71238f13

SHA256
4ceb5f74651638be77d675575bbc7353eda0342d5bf71754cb7cba4ccbc78b37

SHA512
5ee3eb115a116a004341c2ab28e36af2c7fee9f75c82d6f73657cf77ff468ab0827b3319fd7a15e1eba7e311dccdb63ffa462423c8385ab000dac6e2e112e97c

Download Submit
C:\Windows\SysWOW64\Ioolkncg.exe

Filesize
128KB

MD5
5e40b5c76f177c7e432f415e4c4691aa

SHA1
ef24239fe9591846980b547a3a5fb460715460a0

SHA256
740f59acc46d054c05b0c4db4280b8aa166ab15385d3a4c6cf7da60a7d94df43

SHA512
20363160e961c854e59243a8786adcb7552ac4cceaa8b12b2028158bfb09072c632e99a445ceac0772bcec9e36a78cee5dd468c1a73782b4ef341cd3856e2aba

Download Submit
C:\Windows\SysWOW64\Jcfggkac.exe

Filesize
128KB

MD5
122578610582ad9143ff75013febda07

SHA1
b04227886f758a532e5c7e8a39d8712bc728c8b0

SHA256
0d34af4f88d0eb0ec2a5f00fb70099b6713726d3f7106e5fb652819bcfd92536

SHA512
f387e916b8002806c917ac65fdcfe91b854abb1558ec7f5b23c6f79c20f53f5c0048d941a58eb9b22bc433cd89a603841ee3f5fea0ede837c7e4160c677649b9

Download Submit
C:\Windows\SysWOW64\Ljceqb32.exe

Filesize
128KB

MD5
5c85c75ad8f2731da37bb8cec8ddb123

SHA1
9dae6135532dd04e63dd1956f91fdfcf4c4a8a63

SHA256
b3eba640c2cf78f20de2c0c6913b3eb32f39de4ef264b9731477f2d7d5517d5b

SHA512
e9c5c40746d7dc602782ac506415683d33af9dbbb3d98068ee0855022fa5cc4c2bf2d17c27f70cc733239a81d0b7bb767d9bbfd1e68d405ddbe8d1632bc32f81

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
128KB

MD5
b5b5c798c4a1e3b870779d9ac09c9e1d

SHA1
9d75a01c8c867543d19070cd20c3dae4c66dc445

SHA256
e085bc57f1f2f2a2a2e0a2310ed2bab6de1fa27ae988b11d434d55b62fc2cc80

SHA512
b20a35067b892de9946afe4fcd9094cf1c171a23df82ce4b779657e680e43909fb3a7755842746e6168ef5424b0e9e42342781b0a24d911017fcb55081c19636

Download Submit
C:\Windows\SysWOW64\Lncjlq32.exe

Filesize
128KB

MD5
973bfcada231019dbd1f20a9e99d4278

SHA1
e126f2555c141a6dbc62f90ed7812c744f5972f7

SHA256
6dfbb483a4ac8384872b741be69ef0b4a3997d179c06e4def56829b89b5ce08d

SHA512
d0ec38998e41b118322bf558b3845b444f04ad647e667884676c6225f12ca33109dcd13f3235cfa03ea4315a50a8fb8406c0f7612ca71310c6ba6bece86e413e

Download Submit
C:\Windows\SysWOW64\Loighj32.exe

Filesize
128KB

MD5
c3bcc57bab6b7abfaa0a3a8c5252c0e9

SHA1
1dab9f218e10f36388eaa1ceef9ccf30905ed903

SHA256
e9d504dfebf97183e42c6c043720ad6818f624fb4d0dd8870daceb550c125bf4

SHA512
1a008d9aeea8f1f88bb08344da691d6cd58af0441326a99ce722dedd151fbbc27a6085bd5c12aac74b378abd5d0a50703ee93d82aecedf1d08f773962dfc58c5

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
128KB

MD5
56d5057128454568c16b3d0973e3dd9a

SHA1
84058ddea19dfd7dd129792fb6be59effc033405

SHA256
fc8ca9e186a15ab8892f1b32e388025b45ab69fdea7ffac92301352a35f8d91c

SHA512
f056f9b7c9c826eb85be39bffe3bd493f5bd857f566b4369903dd382000399701c6e3bd7af073e09193270d802e9b9bffae72949920cb425c8e3456e67f297cd

Download Submit
C:\Windows\SysWOW64\Mcecjmkl.exe

Filesize
128KB

MD5
70e862b7b84509692b903998c822477d

SHA1
e5f8c0840b077df8e871e2ba3a9fbf0dea0e887d

SHA256
1cad76255c0761fdfd64b76de3d2850cf5c27d56c757f6e3d5609025c9f7eb80

SHA512
5f4eaf32c38f6b53252bbd7f9e9dd60a90c2c0851d343658645d706b7b4e79fb505655d9655272741df88e9367949688a8f512cbb1545e54f58fb7c65821e34f

Download Submit
C:\Windows\SysWOW64\Mcpcdg32.exe

Filesize
128KB

MD5
7f47d5e2ae1b5f65c3f0ba7c3e9f1e65

SHA1
cb182cd171f64a53d3a65694396dbe4bcded5236

SHA256
52b63221720a744e96ae1624a2b67623e926d437e1b632a5ba2658e5b80140a0

SHA512
47f99872155375f233a38aa4bba5ab9e65c042dd6ab721c6a2eeaae4636996dce3addb9bc969a9ededb87fa11427a53dbbf4750a974464706faccbf30c81ee4c

Download Submit
C:\Windows\SysWOW64\Meepdp32.exe

Filesize
128KB

MD5
7ee1eeec31c30f09722d5f7cfe445a11

SHA1
3ad33107215fa768fcb2b3cc94703df3512909f7

SHA256
b1345e5e7292c4abe4dd16f529bd8edce4de4159be4d603dea4a4ffca3320fb4

SHA512
2282a0c26d805bb31da2eeac2958e78335bfb2c08a60489ff88fec199769a73376dcec92ff6c0dab4b1b895e3b320d96fcab4f478adee95fdd8402a97d58dbff

Download Submit
C:\Windows\SysWOW64\Meiioonj.exe

Filesize
128KB

MD5
edcad707a1a9d6523f0e6c4aacb3024a

SHA1
9b2f19e4a2297daf2e4765cbe7e7da2ac00241de

SHA256
e5ed6216d2456f1d00417ba6abed0025b2176a4420cd01daae520c870695fc26

SHA512
8947bc7562a36187bdc6487b238d2ecbf3290a2708b33358d3d8ecc3096355028c23b488952717d4ac6e6657414686c985966a43e952c0a1baeaed8aa3c12ee3

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
128KB

MD5
232ae59fc0b25ed867d32cf088536fbb

SHA1
0a192e67491a9432e451bb8578155f5d0b3b8871

SHA256
6e09cbfa5b515fffc29d1be7054b4b998dfab6958fb6bc7cc52f9191506957f3

SHA512
530da66ffb465b75f3a6e48e4bade2f10440e109c6d14004273125fa7fa7a78d72dd623a336b6611b30de046bc64c66f22c737195d16d11532f829a9e9ed7fcf

Download Submit
C:\Windows\SysWOW64\Mgehfkop.exe

Filesize
128KB

MD5
812b02b29d1c1be299ad496d37e4fe23

SHA1
b589829de5cd2b7dd3af62fdd27b65650b1f7abe

SHA256
a9ab0cb4004b658af307b80f59e1aca6ab427f94d271ba60229cc19ecd5b781d

SHA512
7ea64508bc391dc683de57897948368c0797a977569aae49463c37a0230e4f27f5503d42513cfcb6abf6037cf9db4baabe94db527b9a63fa5891482bdc629a67

Download Submit
C:\Windows\SysWOW64\Mglfplgk.exe

Filesize
128KB

MD5
fd8017a1aa83e4c153000fc5d59a9aff

SHA1
6d7e77b6e349df81185f23fb50b360ac07e81141

SHA256
2c1b98baef5a44d44a70406c4314d7946f0d1c7097525009cfc764ae757cc90c

SHA512
1ed0ba02b36ad08648aa74d151c45cb7dcc1ddf8bc948e91d0cce31c56969fac23a97a7ab6c2f23093f57311a7ffabe8f37ccc258802554c0245eef59df021d0

Download Submit
C:\Windows\SysWOW64\Mgnlkfal.exe

Filesize
128KB

MD5
b8bae104ad394adc7002fde0a615b88d

SHA1
a91cc65fd40d0a4739eb278afd1e5fcdc9d388ad

SHA256
ba8973866763d3b8fda8fcba68995cbd02ee16d0f57e8782906a0bc044314b7c

SHA512
dd9aba67a0550b8d49ce381cf515b98e3a5d079bd822a1cd5923e18c4527cf0df18af32df65042effa9244daf2dd9facb7397069fdc1cb92bdcebda78966e7cb

Download Submit
C:\Windows\SysWOW64\Mgobel32.exe

Filesize
128KB

MD5
2236998f0849df64fed59a26e26487f2

SHA1
d7e2733c17e675ebbcdd10fe4cb7078c0accb28a

SHA256
091e0a297417be03946092b7d43ba5118040255581853f97d237517f1b2694aa

SHA512
1c5d004a65c739231db555205169f031118d1cb4d3a5fad590e0d74c46046c91e650e8fd01ecca782ed9e23e04bd8e6b57464ac90a131390e89e1cb6ddc71bb6

Download Submit
C:\Windows\SysWOW64\Mjkblhfo.exe

Filesize
128KB

MD5
370ffbea051536683ee5db2321ab76a2

SHA1
7f5967569954dc4a206f425a4366ab3604a307c2

SHA256
f2f910e1ba2d5e8016d8ef77f89198f292ee4e78e8bff4b006e441cdfd90d4bd

SHA512
2540bdba51d81d663e88f4858411dbef2e5ba658978f17e94f207d6675de5331a087896113037b675ad4a02892d3cf04955b4c1578bd537469e8ed4e662b3451

Download Submit
C:\Windows\SysWOW64\Mkohaj32.exe

Filesize
128KB

MD5
ebcddd4b7e5cec54018f1bde94700106

SHA1
e78b80fc03ca0a05b15e650cac8ac285e8ca128f

SHA256
cabda8a827d33a7d9b3aa3f0b32e8f3d0528a548bc10437c7310282737ba117f

SHA512
d8a9e757ebae02d1b03e8eb5fa6e49eda59a5e59d236398f23bdee197c143bac0919435a8183078b696f4a32a227c4bf612bd8c6d37f15b873cb42df2a65ce9e

Download Submit
C:\Windows\SysWOW64\Mmbanbmg.exe

Filesize
128KB

MD5
60920983ed1493b443daafc82e5b7d83

SHA1
e818a4171b4bdc841b3b0172bee155c1d2cd0f70

SHA256
03de747cc882c9fdae8b1222ef03d781b12d5b7fa62feed32cea11c2267ef061

SHA512
8575cfbf44476dc28739c45876d5f2de3446d45f4c7999ae3ebd3443d43fb678ac4562dd0c741686851f1386dbd7af8b00e3aa07cf9fc02435748bcd48bda9b9

Download Submit
C:\Windows\SysWOW64\Mnhkbfme.exe

Filesize
128KB

MD5
0487c9e53571b6f442f77ddde9b3de57

SHA1
479f9116a18b8c17a372b431ab98989f7e979659

SHA256
fdd84538b6c34d3232eae784149a9ab2cbdf8797ede1f7740684c9303d42d80d

SHA512
42da92223d2a82dc21e298656106eb2e112e1f8c005d6423b49c017d552dcbf61c2a847f831e000a6507782597d1de8580e41e5d1f0cb18cddcd0c76559bf806

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
128KB

MD5
e010add3c0d216335881cf2c388ed87f

SHA1
25aae4fd3fb5810899d8b927c77502c6cd45c3ce

SHA256
fafc5a167351c86ac2d3b13f56112980d3121f190f7bedaf73604d8ceedb935f

SHA512
0f6d46373ebf7524e0794a8c9a97ce98e68230ff4011bb1730ae123a8325b2f35fd61589be9b995430d630889b87b8ad8f6a0d7547a92e55f303cc5a9bb38659

Download Submit
C:\Windows\SysWOW64\Najmjokc.exe

Filesize
128KB

MD5
a5120558ad5eb5838c99731fc451ca7b

SHA1
b5166c5f3d65433ad89b3ad7436cdd563634a77e

SHA256
afbf94bff7492621b818bfe3ff063b364050f0458e23010c6a09c94b40477b10

SHA512
20daef422b3470086b1bb676be72f0be6933b2832bc38970831c4f04da6b3b6881562d348d3c66cb64e09ede1a47bbd695c91f8fc8830d7b165e91a69e3dcde6

Download Submit
C:\Windows\SysWOW64\Nccokk32.exe

Filesize
128KB

MD5
dd748c1d62d40e2c00ee160d950158d5

SHA1
079df8e0e38c8455b0f508133bd232b29af624c4

SHA256
32152b3d761ea9b28bab11b680304bf69cacf1d99e65076221323b2c9c740c1b

SHA512
e29fd51f091ab5387e70a34cec587462c727d3b789669fb90a618518cc8cba1ccb8ebf5cf7d71bb2f335584ebfb5966034414c5c7e2b8b1884bda5ccbeda5394

Download Submit
C:\Windows\SysWOW64\Nceefd32.exe

Filesize
128KB

MD5
908947ba243f85000b98f5e537bff732

SHA1
b1cf416cf423dab728a8f231be1756dda6ebeab6

SHA256
5df8a672efdd68cb12ec56840522d4054ca35c2130f726e3491de2b7c61d49d2

SHA512
88076ed213c7734066c21f3cb7a818632b2575bb24abf5fea9b318f8f84679beddfb59f8eb7f544cace2290f54826dd4a960c5b7f8ceafb47cc054ba20058b7d

Download Submit
C:\Windows\SysWOW64\Nclbpf32.exe

Filesize
128KB

MD5
3e13d2dd21ecff4a2b3dc399b077e85f

SHA1
e597164505803132321d5aed47331cda76fd802e

SHA256
4dcbc0d9f1f28663e587465ef1b5401f3accd9f753cd8635ffaac27cd28fcf22

SHA512
3c62908cfddf4895fb0727d778a7141dde0e057d3fc1f80e4d59b4e1f4b6d08006bce7310563db984d121c540c9db36cbf5c03d452788a774a90a0f1b53250d3

Download Submit
C:\Windows\SysWOW64\Neclenfo.exe

Filesize
128KB

MD5
6d5665e81e56f169ca9329869aee42c9

SHA1
3581d6328dea300d814ad8fef96d6dc86406b057

SHA256
8b42effdea187146517ba4f25c5b341126ab4cb3d65b7a0b0b25c5cbb765cb1e

SHA512
dbdc0a755394af5810a6470eb54f52d7c2c55490b4020b390cb187f77b9a9182ed94cf0128ce206c214e1f37c5b3391007293d7a289df04fe7bbe78e026a48a2

Download Submit
C:\Windows\SysWOW64\Nelfeo32.exe

Filesize
128KB

MD5
898247b4a83751748fc902e96989395c

SHA1
2601ae18cc664c310b4d7704fe49ccc5713e3b81

SHA256
2161bdef24d3b4dd389ef6710bcc76287f590224a461fe0588f495e894ddf100

SHA512
8533a096a552ed6228f4ecfc3565696aaaabaf604ae94c949eea2dcf9babc1d772db7519bb2b11f6ba6894580e72abdbb2b0fcb167081fbbe82981fbe3cf2a18

Download Submit
C:\Windows\SysWOW64\Nenbjo32.exe

Filesize
128KB

MD5
cf6291f724f46a53a9247c6175022d43

SHA1
52976492867a64d78f449cd7138bf92446393943

SHA256
3fece83fd7b13579b9926845cbc56dffadf5225c0aed43a5d880bdd2cfc3325a

SHA512
7337a9b18bf0f086c0cb036b5649ccf5c69452a046f854bdef6f50ab4ad27ae16ac13f9e53eb0beea4c38a569eaa0105e415ef48014acacde1546698f38cae94

Download Submit
C:\Windows\SysWOW64\Njfagf32.exe

Filesize
128KB

MD5
dd4aed3cbe32622c470df3d36d41df39

SHA1
3e356573ae9c3785f4f90c83ccf4be71d482a791

SHA256
f39b7e517a142938999e15e1907352eb69e1e8917601e3d01ac22b046a55302a

SHA512
92b07d94313afa584091c218f2034e6d52d1b3b124146af9a6c6f4c921bd32a571a10b3ecdeb3795f7e231e127da08b62a2e6c874e505545ddf0c26b797b7adb

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
128KB

MD5
82bb01dd2377d688e5afcf1721290ead

SHA1
0d7a8186b577657ab4bea5839f54cc38e4311a8a

SHA256
2fe9cfba09784d9f369e328f4b8f644b61f5ee7d981be8aad997a0b844b78ed7

SHA512
f6fa4989dfb9f0810d4a00b8ec83eb5da58572f5bc948eadc167cbf490d34d2b48b9bf9caea3b2c7218178924aac64752b446ef07885eeccce0e2d5470356c9e

Download Submit
C:\Windows\SysWOW64\Njmhhefi.exe

Filesize
128KB

MD5
0c64f3f45722b2860090fdceb80fad79

SHA1
f9e1ef9179128b4c7297a6073b635a5dc4798d18

SHA256
8c72bb1a7b0de823407ca9a76e510f905eb4873888b7446e3ab183a2888d2c01

SHA512
8331c82c25ac24a86fdaf40b2a1cdc3e60b6c315799bdb7f86780b0a964068e660a67e5d95c0f460e717b3435b856f932ea9634ec467eea14741c3aaac329f06

Download Submit
C:\Windows\SysWOW64\Nlmdbh32.exe

Filesize
128KB

MD5
a2d3438622659d60e65c7216802fe36a

SHA1
b48eabe0858c7986f05e234d3f9d166bec7b2471

SHA256
bec9c41c403fd07849ed26bfa36184def41fafe001a273939dd17f325b76af1c

SHA512
b00a10f3582b205d216e94efad94b15dac6f277ab80b02ef39756eb00519f4dfc0095a65a08b9acc9935ddb64ee4519d2863a2b2186f0da1d9443b25c45e7343

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
128KB

MD5
14dde3a50f0a2126f5208fd62478deb1

SHA1
e0cbb4d805e9cb610d93ea3bae56c11da20aae34

SHA256
cefa1c06391c98ab5fd8c66ea67b083fbd5c6eab844995db219cacc5006035bf

SHA512
e818b5f60307228a1202c7672320e00fa442c6aa3a47c3630b3ad93d6fc5043eb4829efb94bc4e5f66cd382e056926da9bac3dba05b63f223d66fc2853acf4bf

Download Submit
C:\Windows\SysWOW64\Nmigoagp.exe

Filesize
128KB

MD5
563ef9a82ce3079f4ee2970852828cf7

SHA1
69c478b0028272a4c2b7a6c6239b64e45cb2847b

SHA256
87d625d5a711328ffbe157bb43a42df3fab58806f4fcc10063e9c17c32eb26cf

SHA512
210304d272001e8706f16d1a19d5aa81c09c26688f4596def2b701f22dc78068ff2262fe06bd6e353d9b9dcb764832a63394280f7db3bc0cbd19b1602c5ae64c

Download Submit
C:\Windows\SysWOW64\Nnbnhedj.exe

Filesize
128KB

MD5
bf5cc77e024148fcf6da5cb7db96aafa

SHA1
f78ed83f915c9cdf5d0cc3b1c1645fc1f7f2acf7

SHA256
8e880d0c1e19e39afbf3ae57222a8e3965e8b1e76eed5a041691ab7e63f53a55

SHA512
f3caac957320b8d47925f7094afb8e2a0f245a01c9c2839474e9c54ddf15683881a331d0d5ae7c7282e87f04264878bd75d8e1f254a57b111b247dd1471c8cb0

Download Submit
C:\Windows\SysWOW64\Nndjndbh.exe

Filesize
128KB

MD5
a58ae458dd0fa398fd500cdfbee30f0a

SHA1
9f11e5085e289635494435104ddeb205786e8a05

SHA256
2f1edd8ffeb0944d84382e19a7a6b62f4da142ed75b9caa7ed29c1c0a9671d98

SHA512
e9747307f21f8276f7e34ea3e019c61d41d63407d99423857c0deae24d2c841feacdb96a345d6f6195b357fcd3947ff04ff5bb0c87c29a2db3f3c806c6b2cb13

Download Submit
C:\Windows\SysWOW64\Odmbaj32.exe

Filesize
128KB

MD5
b311782881de9e01a3c2e0c67701269a

SHA1
352d86d5c9546b7e55d9f460b4cf701a064f1228

SHA256
fa97d1cdd06a1dfda4f445717fc0c0d2140b54b3e3d78321dbbecef307d1466d

SHA512
1a9115fd42915d43b669e7212850c88bfc704b9a5540047529334841401d7003fd57c00d63cc6f2b99f47d2076ba424bb359e00f8912ce0af28da31f2d4e2abf

Download Submit
C:\Windows\SysWOW64\Oeehkn32.exe

Filesize
128KB

MD5
97d22a7765b2c119cd7c794812476922

SHA1
9dbe57fbc0323db51a1b6542c094c25bc2feb00f

SHA256
ad253161990ec154b53e64858bb84f4d856671180faa42ee441822fb2af3f5a8

SHA512
f2d258235e6cb678a19d337765aac1ee5196988602f38108ccddd7d24017b45972d7bbd6eac1e2bfd8aacd7262ee50e3b6e61df08773ec73b99ea127367319b7

Download Submit
C:\Windows\SysWOW64\Oelolmnd.exe

Filesize
128KB

MD5
1944c30e19480c57f201d7c260ed15f0

SHA1
331585bcbf688c68d71cd4514b8b3ae2ccf6ae81

SHA256
a5aecf70a37575ba6c33018810df0431524e3330d72a3d73d32ec031b6ba77eb

SHA512
eb9028d98add313c24be4131831dcaf43b42ce4b89c0d02c27ded700cff2a86587be6954c862c263b28a105ba555058cc729f05d4935fbdc31661876a346a7ff

Download Submit
C:\Windows\SysWOW64\Ohlqcagj.exe

Filesize
128KB

MD5
00dc5ea4b486439c3e02c1ac8931de1d

SHA1
853a0b0e6c75f0a982588fcb9351781a2d6f8283

SHA256
a6f45ddf452619c4882fea419038269c2107858c0eeef8d71cdb57a26be08612

SHA512
c28349e14686ebfbc9b52430771486c9353e1d037cc063c364410612a16ba0b1491c191af9af3f07019b15d89923898689416ae472dfe648ff50f4581c57c9d7

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
128KB

MD5
bd7fbe55429fd6989d51ca702be24699

SHA1
cee6de1194de579c81840f034415ba90a7e2f432

SHA256
d11efb274fbac4f6b06242332f3ffc0424aafc6bb94b886c94c43879777889e0

SHA512
f26fa5a1908620c62d36c47c29e7287931f6c8afb884c8ad7dd621970ddd0a4bb6a0069914e447405e0a8caffa804b445457417fcca7570e46918bd2412938d4

Download Submit
C:\Windows\SysWOW64\Olanmgig.exe

Filesize
128KB

MD5
37594dbed6897fbb06d7503dc1316a05

SHA1
c1f13888eca29acde7b0552d9b95fcff720808ac

SHA256
a6cdb6a645af5709f68f8f713dfb5da3dcd0c21edca8989bbc534530d418076b

SHA512
bcac87e7344df26771cf79b48f224a7af190998abe42039ee5bf03d637322e2f9e468840304abf9448a9d055f5027c3f80e71039d15e238601ad9a2e4e97a02e

Download Submit
C:\Windows\SysWOW64\Oloahhki.exe

Filesize
128KB

MD5
1520373db71eab72db8d59d73f3a3588

SHA1
413c6d4df591af64e0b4b43d2162e900d80d1c7f

SHA256
33657b52056d4de06c72aec50b7acc902a493edd0f7174dbb359ce2837774171

SHA512
f762d10110cfa6ccb991f5e8d0c9f3be9142e9c6d46925e5115b950207c5d105153d0189b27e20ac100c904a7fbfd33f4989e05cb94a32e7402ad20cefd67cc6

Download Submit
C:\Windows\SysWOW64\Omcjep32.exe

Filesize
128KB

MD5
f90a1ed582ddb4019547ee2a2912236f

SHA1
2a67725348dc53b589261ac2bc01ac7b30495d8b

SHA256
4bba912c743c4d4a2a8b1dccb4d2136853f5ea5be759b5788cc77b88b8359993

SHA512
2b252c22118fc250b3da96d975d32b9ab40f5121b8369f41881b1bc2bec130a76d38d4849e0cdcfd23ce3fa69b153e6cb597099a08644ef35922896f7ed174dd

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
128KB

MD5
1e432164396d866553c1134068064888

SHA1
43166507035b1652ae0fbf1156646e844149dd1f

SHA256
2c469b944f2e88483f233942bc76f8f6c0978bd617a67bf497e74caccbfb9265

SHA512
9bced2347c39ed1c6564084f903707b50468da59f2d8c39ef1ff0208a09498831055773fa30065d1115c09581b65c55f63bd38eeffbf4e8ab64f213848f1e7c4

Download Submit
C:\Windows\SysWOW64\Paoollik.exe

Filesize
128KB

MD5
478f096de0192143197b20e1f969a934

SHA1
5e52d1c766f7cfa9ad2e7a52a208e44eb2f06aea

SHA256
31564130b4602424d33b200275981497935f38a8609ffe3bf663e527d08cd3bb

SHA512
2788faed1f582c35f2be8daee91c5f834aebf2c137970d5cff39f61695139341d1730dc3bc0dd80bba6f52a6bc64354058d1bbac58c7c6b95611c2fae5095c47

Download Submit
C:\Windows\SysWOW64\Plkpcfal.exe

Filesize
128KB

MD5
e3e8b88c29787b4789aeaaaee1e4e1f1

SHA1
dff372de00ecc1cdc32bc24339317017959b9594

SHA256
530b3f56f099b25516a1ae7e6bbd1721c28697220c76db58bb296a6b4700a156

SHA512
fe26ada9ed16bb27a798f1ad37f32a3386d6ae4bf1a3a6e174f959d9c613f530eadb300ceb6be9a703a5512bb876bf4e0f3d2195ddcf8ee4eeeea6593a54a303

Download Submit
C:\Windows\SysWOW64\Qfkqjmdg.exe

Filesize
128KB

MD5
36c2cc6ef32b26f297ba031a3a0438a5

SHA1
f181fb78aac1a0da3d759148d283274d0eb99ee1

SHA256
712b93113f65c0024167e177e5a829ec40019a3f3c0c7fd05e3445a94b66b209

SHA512
ec8a2c9d1b0628499ac64a4f02e8fc8de024f5479abe77a47fe8f975e66067f1a773b0dc0e8672f4a828b2ef3f8d427ed9031252f5dde759c8ad46399ffac6a4

Download Submit
C:\Windows\SysWOW64\Qjiipk32.exe

Filesize
128KB

MD5
fec6a59353c1b4d91f1397036b50e5a3

SHA1
7070e0e4bf97699971d330f6b245fa70160fc5ff

SHA256
48cfa0d73e04647e3f2db29b1be550ec775022149aa495532ea587cc319f32c3

SHA512
348505bc7de7a3fc77cdddeaa3415b1b75da3743dd74a923a384bcf6cb724e2249313fd5d39c560b638a4e3e860e949a4d1cfe9861b8b15d2a45f80d13f7e25b

Download Submit
memory/208-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/376-532-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/380-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/520-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/540-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/852-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/904-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/940-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1148-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1368-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-544-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1680-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1804-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1996-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-508-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2136-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2136-579-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2180-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2316-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2400-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2512-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-572-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2680-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2848-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2980-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3100-530-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3264-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3400-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3412-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3444-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-520-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-514-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3536-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3556-183-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3616-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3636-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3652-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3664-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3664-558-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3676-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-551-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3744-119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3804-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3808-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3840-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3968-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3984-478-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3988-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-586-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4248-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-506-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4480-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4500-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4552-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4568-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4572-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-565-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4952-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-593-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4992-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5024-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5092-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5156-573-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5212-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5268-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5312-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9960-2611-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads